Forge — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Forge (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <img width="1500" height="276" alt="forge-banner" src=".github/assets/forge_banner.jpg" /> </div>
<div align="center">
<p><strong>Universal Agent Harness — Drop your agents. Watch them evolve, remember and win.</strong></p>
<br/>
</div>
Forge is an open-source, enterprise-grade agent harness that wraps any multi-agent flow and gives it real-time cost tracking, cross-run memory, OpenTelemetry tracing, spec-driven governance, and an opt-in self-evolution loop — in one command.
Every feature in this document maps to a test. See docs/feature-map.md. Items not yet shipped live in the Roadmap.
pip install forge-os
forge wrap my_langgraph_flow.py --input '{"query": "What is RAG?"}'⚡ FORGE — Universal Agent Harness
Drop your agents. Watch them evolve, remember and win.
✓ Detected: langgraph (11ms)
Running task_id=a3f8b2c1...
╭─ Run Info ──────────────────────────────────────╮
│ Status ✓ COMPLETED │
│ Task ID a3f8b2c1d4e5... │
│ Duration 4.2s │
╰─────────────────────────────────────────────────╯
╭─ Cost Breakdown ────────────────────────────────╮
│ agent: researcher $0.00420 │
│ agent: writer $0.00180 │
│ TOTAL $0.00600 │
╰─────────────────────────────────────────────────╯
╭─ Agent Topology ────────────────────────────────╮
│ ├── [research] Researcher (claude-sonnet) │
│ └── [writing] Writer (claude-haiku) │
╰─────────────────────────────────────────────────╯| Build from scratch | Forge | |
|---|---|---|
| Wrap any framework | ✗ Manual | ✓ 1 command |
| Real-time cost tracking | ✗ Manual | ✓ Per-agent, per-model |
| Self-optimization loop | ✗ You build it | ✓ Opt-in, snapshot-safe |
| Cross-run memory | ✗ None | ✓ Hybrid vector + graph + symbolic |
| Tool governance (MCP) | ✗ None | ✓ 8-layer pipeline |
| Spec-driven quality gates | ✗ Manual | ✓ SLSA Level 2 attestation |
| Audit trail | ✗ Log files | ✓ Full provenance chain |
| Production-ready | ✗ Weeks | ✓ Day 1 |
Wraps LangGraph, CrewAI, AutoGen, or any async callable. No migration required. Framework is auto-detected from imports.
Every run generates telemetry. The evolution loop analyzes it and proposes (or auto-applies) mutations:
PromptRewriteMutator)ModelSwapMutator)TopologySnapshot (AgentCullMutator)ParameterTuneMutator)Auto-trigger is off by default. Three consecutive failed mutations open a circuit breaker and suspend the loop until an operator calls forge evolve resume or orchestrator.resume_evolution().
forge evolve run my_flow.py --mode auto
# ⚗ Proposed: Swap researcher from claude-opus → claude-sonnet
# ↳ Applied. Fitness: 0.72 → 0.91 (+0.19)
forge evolve status # read the journal
forge evolve resume my_flow.py # re-arm the breakerA hybrid knowledge base that accumulates and retrieves knowledge across runs:
HybridMemoryforge memory query "optimization techniques the researcher found last week"
forge memory ingest my_document.txt --tag topic=RAG
forge memory statusFORGE_PRICING_TABLE_PATH → ~/.forge/pricing.json (7-day TTL) → bundled table; unknown models warn loudly instead of silently billing $0--budget 1.50) — runs cancelled at the ceilingforge observe # open the live dashboard
forge doctor # diagnose your installation
forge doctor update-pricing # refresh the local pricing cacheRoutes, secures, and budgets all Model Context Protocol tool calls through an 8-layer governance pipeline:
forge mcp list-tools # show available tools
forge mcp call <tool> <args> # invoke a tool
forge mcp serve # expose Forge memory + evolution as MCP tools
forge mcp status # inspect budget and cache stateContext-aware rule packs with a fixed precedence lattice and compile-time scope analysis:
MOST_SPECIFIC_WINS or PRIORITY_FIRST_MATCHforge rules validate my_rules.yaml
forge rules lint my_rules.yaml # find scope overlaps
forge rules explain --path "src/**" # show which rules apply
forge rules diff v1.yaml v2.yamlIntent-based skill dispatch with structured SKILL.md loading:
agent_id scoped to the parent run_idasyncio.wait_forforge skills list # show loaded skills
forge skills explain <name> # describe parameters and examples
forge skills run <name> <args> # invoke a skillStructured acceptance criteria, deterministic attestation, and evolution guardrails:
ConstraintViolationError before any spec-breaking change is appliedforge spec init my_feature.yaml # scaffold a new spec
forge spec verify --spec my_feature.yaml --result run.json
forge spec attest --spec my_feature.yaml # generate provenanceParallel review pipeline with severity-based blocking:
on_plan, pre_apply, pre_stop, pre_mergeErrorRateReviewer, CostCeilingReviewer, SpecConstraintReviewer, StatusReviewerforge review run --context run.json
forge review show --id <review_id>Diagnose a local install in one command: Python version, installed adapter extras, active memory backends, environment variable state, and optional network egress (--network).
┌───────────────────────────────────────────────────────────────────────┐
│ forge wrap my_flow.py │
└───────────────────────────────┬───────────────────────────────────────┘
│
┌──────────▼──────────┐
│ MetaOrchestrator │ forge-os-core
│ Detect + Instrument│
│ + EventBus + Run │
└──┬──────────────────┘
│
┌───────────────┼──────────────────────┐
│ │ │
┌────▼────┐ ┌──────▼──────┐ ┌──────────▼───────────────┐
│ Adapter │ │ Observe │ │ Living Collaborative │
│ │ │ OTel + Cost │ │ Memory │
│ Lang │ │ REST + SSE │ │ Vector+Graph+Symbolic │
│ Graph / │ └─────────────┘ │ HybridMemory + RRF │
│ CrewAI /│ └──────────────────────────┘
│ AutoGen │
└─────────┘
│
┌────▼────────────────────────────────────────────────────────┐
│ Governance Layer │
│ │
│ ┌────────────┐ ┌──────────────┐ ┌──────────────────┐ │
│ │ forge-rules│ │ forge-spec │ │ forge-review │ │
│ │ Deny/Req/ │ │ SpecVerifier │ │ P0–P3 severity │ │
│ │ Suggest │ │ + Attester │ │ CascadingReviewer│ │
│ └────────────┘ └──────────────┘ └──────────────────┘ │
│ │
│ ┌────────────┐ ┌──────────────┐ │
│ │ forge-mcp │ │ forge-skills │ │
│ │ 8-layer │ │ IntentDispatch│ │
│ │ pipeline │ │ + SKILL.md │ │
│ └────────────┘ └──────────────┘ │
└─────────────────────────────────────────────────────────────┘
│
┌────▼─────────────────────────┐
│ Evolution Loop │ forge-os-core
│ Observe → Hypothesize │
│ → Mutate → Evaluate │
│ → Commit / Rollback │
└──────────────────────────────┘Full write-up in docs/architecture.md.
# Core harness + CLI (LangGraph, CrewAI, AutoGen adapters require extras)
pip install forge-os
# With framework adapters
pip install 'forge-os[langgraph]'
pip install 'forge-os[crewai]'
pip install 'forge-os[autogen]'
pip install 'forge-os[all]' # all adapters
# Governance and tooling extras
pip install 'forge-os[rules]' # context-aware rule packs
pip install 'forge-os[mcp]' # MCP meta-orchestrator
pip install 'forge-os[skills]' # skills runtime
pip install 'forge-os[spec]' # spec-driven development
pip install 'forge-os[review]' # review agents + policy gatesRequirements: Python 3.11+. No Docker required for local development.
# my_flow.py
from langgraph.graph import StateGraph, END
from typing import TypedDict
class State(TypedDict):
query: str
answer: str
def researcher(state: State) -> State:
return {"answer": f"Research: {state['query']}"}
graph = StateGraph(State)
graph.add_node("researcher", researcher)
graph.set_entry_point("researcher")
graph.add_edge("researcher", END)
app = graph.compile()forge wrap my_flow.py --input '{"query": "What is RAG?"}'forge wrap my_flow.py \
--input '{"query": "Latest agent harness papers"}' \
--evolutionimport asyncio
from forge_core.harness import MetaOrchestrator
from forge_core.types import TaskEnvelope
async def main():
orchestrator = MetaOrchestrator()
await orchestrator.load("my_flow.py")
result = await orchestrator.run(
TaskEnvelope(input={"query": "What is Forge?"})
)
print(f"Cost: ${result.cost.total_cost:.5f}")
print(f"Duration: {result.duration_ms:.0f}ms")
print(f"Output: {result.output}")
asyncio.run(main())forge spec init acceptance.yaml
# edit acceptance.yaml — define ASSERTION/REGEX/CONTAINS criteria
forge wrap my_flow.py --spec acceptance.yaml --evolution
# SpecConstraintGuard now blocks any mutation that would violate the specForge ships as eleven composable packages. Installing forge-os pulls the core set; optional extras add the governance and tooling layers.
| Variable | Default | Description |
|---|---|---|
FORGE_ENABLE_EVOLUTION_AUTO | 0 | Auto-apply evolution mutations without human approval. Off by default; enable only in trusted environments. |
FORGE_ENABLE_LLM_JUDGE | 0 | Score run quality with an LLM call after each run. Adds ~1 LLM call per run. Expected cost: ~$0.001/evaluation at Haiku pricing. |
FORGE_LLM_JUDGE_MODEL | claude-haiku-4-20250514 | Model used by the LLM-as-judge scorer when FORGE_ENABLE_LLM_JUDGE=1. |
FORGE_LLM_CIRCUIT_BREAKER | 1 | Enable the LLM circuit breaker (trips after 5 consecutive failures; 30s recovery window). |
FORGE_ENABLE_MEMORY_INJECTION | 0 | Inject relevant memory context into each run before agent execution. |
FORGE_ENABLE_LLM_ENTITY_EXTRACTION | 0 | Use an LLM to extract entities for the graph memory layer after each run. |
FORGE_INTENT_MODEL | (configured) | Model used by the IntentClassifier for skill and rule routing. |
FORGE_INTENT_CONFIDENCE_THRESHOLD | (configured) | Minimum confidence score before the intent classifier dispatches a skill. |
FORGE_OBSERVE_MAX_SSE_SUBSCRIBERS | 50 | Maximum concurrent SSE subscribers on the live event stream. Returns HTTP 503 beyond this limit. |
FORGE_API_ALLOWED_ORIGINS | (empty) | Comma-separated CORS origins for the observe API. Empty = same-origin only. |
FORGE_PRICING_TABLE_PATH | (empty) | Path to a JSON pricing table that overrides the bundled prices. |
FORGE_PRICING_TABLE_URL | (configured) | URL used by forge doctor update-pricing to refresh the local pricing cache. |
FORGE_OBSERVE_AGENT_BASE_URL | (empty) | Base URL published in the A2A Agent Card at /.well-known/agent.json. |
v0.2.0 is live — the full governance platform (forge-spec, forge-review, forge-rules, forge-skills, forge-os-mcp) ships in this release alongside the core harness, adapters, memory, and observability stack.
Planned for upcoming releases:
Anything that graduates to shipped must land with a row in docs/feature-map.md.
Issues, bug reports, and pull requests are welcome — see CONTRIBUTING.md and open an issue at github.com/angelnicolasc/forge/issues.
Security reports: please read SECURITY.md.
Apache 2.0 — enterprise-friendly, commercial use allowed. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.